fix(pom): recursive check all nested depManagements with import scope

[DmitriyLewen]

Description

This PR corrects 2 related problems:

• we need to check all nested depManagements using import (recursively running resolveDepManagement).
• exclude shadow overwriting of props when some iterations of nested depManagements use the same props (e.g., ${project.version}).

See updated import dependencyManagement test for more details.

Related Issues

• Trivy does not identify certain imported pom files trivy#5899

[knqyf263]

Do we need this level nest? IIUC, the new test is importing pom as below.

• import-dependency-management/pom.xml
  • example-dependency-management@3.3.3
    • example-dependency-management2@3.3.3
      • example-dependency-management3@2.2.2

I'm wondering if a two-level nest is enough.

• import-dependency-management/pom.xml
  • example-dependency-management@3.3.3
    • example-dependency-management2@1.1.1

e.g. knqyf263@b8d492f

I'm probably missing something. Please let me know what we want to test with the test case.

[DmitriyLewen]

These 3 nested depManagements and dependency tag for 1 of them are required to show the need of clone map properties.

I found this problem after adding recurcive - we overwrite the properties in the shadow.

[knqyf263]

Reverting your change failed the test, meaning the simplified test can catch the edge case you found, right?

[knqyf263]

BTW, I wanted to push the commits for testing to my fork, but pushed them to your form by mistake. Sorry 😔

[DmitriyLewen]

Reverting your change failed the test, meaning the simplified test can catch the edge case you found, right?

I updated PR description to better understand fixes in this PR.

I created similar of your test first(f7ec709). But after investigation more i found second problem (overwrite props).

Your test only checks first fix (nested depManagements).
But if you revert these changes (shadow overwrite props) you still pass test.

BTW, I wanted to push the commits for testing to my fork, but pushed them to your form by mistake. Sorry 😔

No problem. I will revert these changes when we are done discussing these fixes.

[knqyf263]

Thanks. I now understand what it was testing. As per your explanation, I've added properties causing the overriding bug. Could you take a look?

[DmitriyLewen]

I was so focused on example from aquasecurity/trivy#5899 that I didn't even think to just declare new property 😄

This is what i wanted to check in my test.
Thank you for making this test easier!

[knqyf263]

Thanks for confirming.

[knqyf263]

I was so focused on example from aquasecurity/trivy#5899 that I didn't even think to just declare new property 😄

I wasn't part of that discussion, so I was able to focus on the essential issue 👍